spiralocean
Apr 10 2004, 11:53 AM
Hello,
A couple months back when I first joined SpamCop, I forwarded all me email to my SpamCop email and then retrieve my email from SpamCop to my local email application (Mac OS X Mail).
The webhosting service that I subscribe to does not have any rules that will forward email. Instead I delete my email account and set up an email alias that forwards to my spamcop account. This means I no longer have a physical account at my webhosting site. But any emails sent to that site are forwarded to my spamcop.
Well, after a couple days all of the sudden ALL my email was being held. Spam filtering didn't exist because it was treating everything as spam. So I had to whitelist everyone who wasn't spam. Which seemed to defeat the entire purpose of the SpamCop blacklist.
I soon found out that my webhosting company was being blacklisted because of my email/alias forwarding. So I added my email back to my webhosting company and changed the spamcop settings to pop my email account.
The problem with this method is it only pops my email account every 20 min. Sometimes I need to see responses to emails sooner than that.
I would like to go back forwarding email from my webhosting company using an email alias and was wondering if the new mailhosting verification that spamcop is using is going to fix this? I have registered my local email address with spamcop.
Is there someone out there that can confirm or deny this?
Thanks.
Wazoo
Apr 10 2004, 12:00 PM
Basically, I don't see how any one cal really tell you anything, based on what you've provided thus far. To answer any one of your specific queries with a specific answer, one would need to see the headers of the e-mails involved. I can't even figure out your"they don't forward, but I created an alias that forwards" from just what little you've stated, and from what you've stated, this is the cause of a problem. IP addresses involved might help, but an actual header to let "us" see the way the e-mail travelled is the only way to address your issue directly.
spiralocean
Apr 10 2004, 02:12 PM
Well you have a point. I'll just try it and see if my Webhosting company gets blacklisted again. To try and clear up some of the confusion in my first post:
1. With previous webhosting companies I have had, to forward your email you first set up an email account with them, or basically an inbox on their server. Then you create rules inside of that inbox that forward your email to another email address.
2. With the webhosting company that I am with now, they do not offer this method.
3. Instead I must delete my email inbox from their server.
4. Then create an alias with my email address that forwards to my spamcop email address. So my email has no inbox on their server. When an email is sent to me, it arrives at my webhosting companies server and then just bounces to my spamcop email address. (Is this called a relay?)
5. I'm assuming this was the problem that caused webhosting company to be blacklisted.
Part of the confusion lies with my limited understanding of all the technical terms for how an email travels through the internet.
spiralocean
Apr 10 2004, 02:13 PM
To boil my question down to one sentence:
If I am forwarding my emails to my spamcop account by using an alias, will spamcop blacklist my webhosting company.
Wazoo
Apr 10 2004, 02:31 PM
Ok, to boil the answer down to one line (and you have no idea how hard that is for me <g>)
Yes, your web-hoting company "can" be listed if the header lines are not "good" and you also allow the reports to be sent to/about your web-hosting company by not removing the "checkmark" if it's there ....
spiralocean
Apr 10 2004, 02:37 PM
Excellent! Thank you! I realize it's hard for you dealing with people who are true newbies at this. Thank you for the kind response.
If I may ask a follow up question:
Is there documentation or a link you know about that describes best practices for checkintg the header? I know how to view it, but haven't much of an idea of what is a good header vs a bad header.
Also, Is it possible for my webhosting company to be listed by serveral different names? How do I make sure I'm not reporting my own company? Is there a place for me to go to list all the ip's or domain name of the servers?
I know if I see IVC then I won't report it. But will it go by that name that I am familiar with?
Some of these questions would be great to have in the FAQ.
spiralocean
Apr 10 2004, 07:53 PM
Okay, so I have an email that I'm looking at, and in the spamcop reporting it lists my webhosting site in the header. But I've also registered my mailhost in the mailhost webpage on spamcop. Does that mean that spamcop knows this is my mailhost and it won't mark my mailhost as spam?
When I scroll down, there isn't anything checked with the name of my mailhost on it. However, there are some reporting to the SpamCop internal handling. Does this mean it is going to report my mailhost as a spammer to the blacklist?
StevenUnderwood
Apr 10 2004, 08:33 PM
If you post the tracking URL (page you see the report on), we can see the same thing and give you specifics. You may wich to cancel the report first as anyone can submit the report and if it is wrong, it is attributed to you.
There should be a description under the individual parsing steps:
Spamcop received from <mailhost>
<mailhost> received from IP address
Then it wil figure out how to report IP address.
As long as IP address is not part of your standard mail route, you should be OK.
You could have more mailhosts than two (spamcop and <mailhost> in my example.
spiralocean
Apr 11 2004, 12:11 AM
Okay... here is the link to the report:
When you said,
As long as the IP address isn't part of my normal mail route I should be okay.
Which IP address is that? Is this the IP where the spam originated? And my normal mail-route is including my mailhost?
Thank you for the response. I want to be reporting the spam but want to make sure I do it correctly.
StevenUnderwood
Apr 11 2004, 06:40 AM
IP Address would be the IP Address of the machine that connected to <mailhost>. I should have used <> around it to set it off.
This message was a clean one reporting the telus.net address that connected to your mailhost configuration.
CODE
Parsing header:
0: Received: from unknown (192.168.1.101) by blade6.cesmail.net with QMQP; 11 Apr 2004 02:08:37 -0000
Internal handoff at SpamCop
Spamcop sent it to another internal spamcop machine.
CODE
1: Received: from ns3.ivcdns.com (HELO ivchost3.com) (207.44.232.49) by mailgate.cesmail.net with SMTP; 11 Apr 2004 02:08:37 -0000
SpamCop received mail from Local ( 207.44.232.49 )
Hostname verified: ns3.ivcdns.com
Spamcop received message from your mailhost labeled Local.
CODE
2: Received: from unknown (HELO tvtravelshop.co.uk) (64.180.209.131) by localhost with SMTP; 11 Apr 2004 02:08:52 -0000
Local received mail from 64.180.209.131
Hostname verified: d64-180-209-131.bchsia.telus.net
Your mailhost labeled Local received the message from the telus.net address.
CODE
All mail hosts in chain recognized.
This is a good message meaning there are no undefined IP addresses in the chain. The only IP address not in your mailhosts configuration was tracked as sending to your mailhost config and is being reported.
CODE
Reports regarding this spam have already been sent:
Reportid: 882803502 To: cancelled[at]devnull.spamcop.net
In this context, I don't get to see why it sent a report to cancelled[at]devnull.spamcop.net. Are you a "mole" reporter?
Wazoo
Apr 11 2004, 10:00 AM
QUOTE
But I've also registered my mailhost in the mailhost webpage on spamcop. Does that mean that spamcop knows this is my mailhost and it won't mark my mailhost as spam?
Don't use the e-mail side of th house, but it sure seems to me that there's supposed to be some interaction going on with registering into the "mail-host" thing ... so I'd have to suggest that if you haven't had e-mail traffic to/from the SpamCop system, you haven't been "there" yet or haven't finished, which also suggests that most recent guidance is that you hold off on reporting until mail-host configuration is completed. However, noting that StevenUnderwood's parse of your query seems to suggest that things are OK, at least on the surface.
Wazoo
Apr 11 2004, 10:08 AM
QUOTE
Is there documentation or a link you know about that describes best practices for checkintg the header? I know how to view it, but haven't much of an idea of what is a good header vs a bad header.
http://home.att.net/~marjie1/index.htm is a fine start.
spiralocean
Apr 12 2004, 04:06 PM
QUOTE(StevenUnderwood @ Apr 11 2004, 05:40 AM)
CODE
Reports regarding this spam have already been sent:
Reportid: 882803502 To: cancelled[at]devnull.spamcop.net
In this context, I don't get to see why it sent a report to cancelled[at]devnull.spamcop.net. Are you a "mole" reporter?
I'm not a mole, but I play one on TV. ;-)
I didn't actually send this report in, I hit cancel after queuing it.
spiralocean
Apr 12 2004, 04:10 PM
QUOTE
(StevenUnderwood @ Apr 11 2004, 05:40 AM)This is a good message meaning there are no undefined IP addresses in the chain. The only IP address not in your mailhosts configuration was tracked as sending to your mailhost config and is being reported.
Thanks for the help in parsing it. I haven't been sending any reports out, and would love to, as long as I know I'm reporting correctly. Some documentation on the site about how to report, what to look for, how spammers work, would be extremely educational.
Thanks for your help.
spiralocean
Apr 12 2004, 04:12 PM
QUOTE(Wazoo @ Apr 11 2004, 09:08 AM)
QUOTE
Is there documentation or a link you know about that describes best practices for checkintg the header? I know how to view it, but haven't much of an idea of what is a good header vs a bad header.
http://home.att.net/~marjie1/index.htm is a fine start.
Excellent! Thanks for the help Wazoo.
spiralocean
Apr 13 2004, 10:17 PM
Okay... sorry to keep bringing this up.
But when I am reporting spam, the only thing that is important is that I do not send a spam report to my mailhost if it appears?
Or...
If I uncheck a report being sent to my mailhost my mailhost is still being added to spamcops blacklist but no report is being sent to my mailhost admin?
Let me try again, here is my process:
When I report spam to spamcop,
1. Search to see if my mailhost is listed in the report section.
2. If it is listed, cancel reporting the spam. If I simply uncheck the box that sends a report to my mailhost, my mailhost is still being sent to spamcops blacklist.
Basically, I am confused... that's a given, but in spamcops reporting, I'm confused what IP's are being reported as spam. I always assumed it was only the ones with the checkbox on them. But if inchecked will the IP's be reported to SpamCop?
Any clarification or examples of how others go through the headers would be helpful.
Thank you.
Wazoo
Apr 14 2004, 12:05 AM
QUOTE
the only thing that is important is that I do not send a spam report to my mailhost
You are repsonsible for the entire set of reports going out ... reporting your own ISP has a tendency to make that mistake get recognized much sooner than other possible mistakes.
QUOTE
uncheck a report being sent to my mailhost my mailhost is still being added to spamcops blacklist
if you "uncheck" a report target, there is no report generated for that target ... so no adding to the BL .... noting that the SpamCop BL only concerns itself with the source IP of the spam e-mail. You may have the opportunity to send 6 reports out, but only one of those 6 would have anything to do with an entry into the BL.
spiralocean
Apr 14 2004, 09:09 AM
Allright! Thanks for the confirmation Wazoo! You've been a great help.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.